[ASDAlexander77]

Fixes fuzzer repro 80194 (#646), found in a fresh range (80001). It fails on main.

const c15: () => number = G.items[0].get;
G = mk(4);           // frees the old G, its items, and the V c15 is bound to
print(c15());        // 4.94066e-324, then the assert fails

Why

Under rc, a const made over a read of a field, an element, a global or a local holds a count of its own (processConstRef, needsIdentityStorage). That includes an interface or a bound method made over such a read, which #644 covered. viewedValue finds the value a bound method is made over, but it didn't look through casts. A declared type (const c: () => number = ...) casts the bound method to a hybrid function, so no read was seen. The const was then folded, with no count.

Fix

viewedValue strips casts before it looks for the interface or the bound method. Its callers already handle what it returns.

Tests

tests/00const_bound_method_declared_type.ts has a declared-type bound method over each of:

• an element of a global (the fuzzer's shape)
• a field of a global
• a field of a local
• a local
• a global reassigned in a loop

Each case fails on its own under rc on Linux without the fix. The object's x is its first field, so the bytes glibc writes into a freed block overwrite it. The test runs compiled, under JIT, and in the rc/none corpus.

Verification

• ctest -C Release: Windows 5316/5316, measured before An element is stored into once the value is ready #658 was merged in (that merge had no conflicts).
• WSL Linux, together with the 80037 fix: 5304/5304.

🤖 Generated with Claude Code